Threat Intel Docs

STIX 2.1 export and direct IOC access

BlackDome provides direct IOC queries and STIX 2.1 export for the current product. TAXII, Enterprise, and OEM delivery are candidate contact-led scoped pilots; their availability and delivery shape are agreed before any commitment is made.

Start Free Open Dashboard

Auth

Bearer token

Send Authorization: Bearer bd_... on every request.

Delivery

STIX + JSON

Use STIX export or the direct IOC endpoint for automation and local tooling.

Data

1,500+ IOCs

Indicators sourced from the BlackDome honeypot mesh and ThreatDrop detections.

Authentication

Use your API key as a Bearer token

The Threat Intel Feed uses an API key for direct IOC access and STIX export.

Request header

Add this header to direct IOC requests.

Authorization: Bearer bd_your_key

Endpoints

Core Threat Intel endpoints

Use the direct IOC endpoint for scripts, enrichment workers, and custom pipelines.

GET /api/blackdome/iocs

Direct IOC query endpoint for JSON clients, scripts, and enrichment jobs.

curl -H "Authorization: Bearer bd_your_key" \
  "https://blackdome.ai/api/blackdome/iocs?type=indicator&limit=50"

SIEM

Delivery discussion

STIX export and direct IOC access are current. TAXII, Enterprise, and OEM delivery are candidate contact-led scoped pilots.

Current access

Use STIX export or the direct IOC endpoint with your API key for your current workflow.

Candidate pilot

TAXII delivery can be discussed as a candidate scoped pilot; it is not a fixed public availability commitment.

Enterprise and OEM

Enterprise and OEM requests begin as contact-led scoped pilots with delivery agreed to the evidence workflow.

Rate Limits

Per-tier limits

Community and Pro are the current self-service tiers. Enterprise and OEM delivery are candidate contact-led scoped pilots.

Tier	Limits
Community	100 IOCs/day, 30 rpm, 72-hour delay
Pro	5,000 requests/day, 300 rpm, real-time API access

Response Format

Example direct IOC response

Direct IOC queries return tenant-scoped indicators with confidence, ATT&CK context, sighting counts, and metadata.

JSON example

Real fields returned by GET /api/blackdome/iocs.

{
  "total": 2,
  "iocs": [
    {
      "id": "3dfdf2f7-f637-4b7b-bb42-983b4f8b94fe",
      "ioc_type": "ip",
      "ioc_value": "91.92.242.79",
      "confidence": 91,
      "effective_confidence": 96,
      "severity": "high",
      "verdict": "malicious",
      "mitre_tactics": [
        "credential-access"
      ],
      "mitre_techniques": [
        "T1110"
      ],
      "source_type": "honeypot",
      "tags": [
        "bruteforce",
        "ssh",
        "credential-theft"
      ],
      "sighting_count": 43,
      "first_seen": "2026-03-18T04:21:00+00:00",
      "last_seen": "2026-03-20T02:48:00+00:00",
      "metadata": {
        "country": "RU",
        "asn": "AS12389"
      }
    },
    {
      "id": "bece3aaf-8be2-4625-810f-efb07a17f4a0",
      "ioc_type": "domain",
      "ioc_value": "secure-payments-login.example",
      "confidence": 82,
      "effective_confidence": 82,
      "severity": "medium",
      "verdict": "phishing",
      "mitre_tactics": [
        "credential-access"
      ],
      "mitre_techniques": [
        "T1566"
      ],
      "source_type": "threatdrop",
      "tags": [
        "brand-abuse",
        "phishing-kit"
      ],
      "sighting_count": 9,
      "first_seen": "2026-03-19T11:14:00+00:00",
      "last_seen": "2026-03-20T01:08:00+00:00",
      "metadata": {
        "redirect_chain_length": 2
      }
    }
  ],
  "limit": 50,
  "offset": 0
}